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Dear Mr. Chairman: 


This report is part of a broader study of federal peer review programs in 
response to your January 8, 1990, request. As agreed with the Com- 
mittee, we made a limited assessment of compliance with selected provi- 
sions of the Privacy Act and the Federal Advisory Committee Act (FACA) 
in the peer review process at six agencies. 


Federal agencies that fund external grant programs in the sciences, arts, 
and humanities frequently use outside experts or professional “peers” 
to review grant applications and help the agency decide which proposed 
projects to fund. The purpose of peer review is to obtain independent, 
outside advice by qualified experts. 


Both the Privacy Act and FACA provide a legal basis to ensure the confi- 
dentiality of the peer review process. The Privacy Act provides the 
basis to protect the written records kept in individual applicant files 
from public disclosure. FACA provides the basis for closing peer review 
panel meetings to the public and protecting any personal information in 
the minutes of panel meetings from public disclosure. 


ee 
: : In determining compliance with the Privacy Act and FACA, our objectives 
Objectives, Scope, and were to (1) determine how peer review records were kept and whether 
Methodology applicants had access to their records; (2) identify peer review records 
that may have been misclassified as being subject to, or exempt from, 
the Privacy Act; and (8) determine whether peer review panels were 
chartered and operated as advisory committees in compliance with FACA. 


Because our initial work showed there was limited potential for findings 
in this area, we curtailed our planned work at the completion of our 
initial survey, with the Committee’s agreement. As a result, we limited 
the number of grant application files we reviewed, peer review panel 
meetings we attended, and agencies we included in our scope. 


.. 
WELLCOME 7 


LIBRARY 


As agreed with the Committee, we initially selected 6 of the more than 
12 agencies with grant programs that use outside experts in the peer 
review process. We selected agencies that would give us a mix of the 
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humanities and the physical, medical, and social sciences. We did our 
work at the National Science Foundation (NSF), National Institutes of 
Health (NIH) of the Department of Health and Human Services, Depart- 
ment of Energy (DOE), Department of Veterans Affairs (vA),! National 
Oceanic and Atmospheric Administration (NOAA) of the Department of 
Commerce, and National Endowment for the Humanities (NEH). 


At each of the six agencies, we interviewed those officials who adminis- 
tered the peer review process and asked them to describe their peer 
review procedures, including what records were maintained, whether 
the records contained personal information, and whether the records 
were classified as Privacy Act records. We asked officials whether indi- 
viduals had access to the information in their files and what type of 
access was provided. Finally, we asked the officials whether they used 
peer review panels, whether the panels were chartered as advisory com- 
mittees under FACA, and how the panels were operated. 


We also reviewed written agency procedures governing the peer review 
process, the Privacy Act, and FACA, at each of the six agencies. We also 
interviewed each agency’s Privacy Act and FACA management officers 
and officials in their General Counsel and Inspector General offices to 
determine their involvement in the agency’s peer review program. 


Through an examination of agency files, we did limited tests of each 
agency’s compliance with Privacy Act procedures regarding the (1) 
retrieval of records by name or other personal identifying information 
(termed personal identifiers), (2) inclusion of personal information in 
the files, and (8) extent to which applicants had access to their records. 
Because DOE and NOAA did not classify their peer review records as Pri- 
vacy Act records, we also tested to determine if these agencies were 
using other means, such as an automated grant application tracking 
system, to retrieve peer review records by name or by a personal identi- 
fier. Examples of personal identifiers include social security numbers, 
fingerprints, or photographs. 


We tested compliance with FAcA provisions on the preparation of panel 
minutes or summaries. To do this, we reviewed 215 peer review files 
selected from among the 6 agencies’ active grant application files. Active 
files generally included those applications that were peer-reviewed 


1VA funds medical research by VA staff physicians and research scientists through an external peer 
review program. Although the awards are not grants, the VA program is operated in a similar manner 
to research grant programs in other agencies. 
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within the last 1 to 3 years. We reviewed between 26 and 46 files in each 
agency and selected consecutive files from 1 or more file drawers in 
each office. Although there was no known bias in our selection process, 
the samples were not randomly selected. 


We also observed five peer review panel meetings in four agencies—vA, 
NEH, NIH, and NSF—to determine if they were generally functioning as 
agency officials described them. We did not attempt to determine if the 
agencies, whose panels were not chartered under FAGA, were seeking con- 
sensus advice from the panels, as opposed to seeking the advice of each 
panel member separately, or if agency officials used the panel results as 
a source of consensus. Seeking consensus or using panel results as a 
source of consensus is a factor in determining whether a meeting of 
outside experts is governed by FACA. 


We did our work in one or more of each agency’s major grant awarding 
program offices at Washington, D.C., headquarters locations. We did our 
work from January 1990 to October 1990 in accordance with generally 
accepted government auditing standards. 


Peer review records in four agencies—VA, NEH, NSF, and NIH—were prop- 
erly classified as Privacy Act records because they contained personal 
information and were retrieved by the agencies through the individual’s 
name or some other personal identifier. DOE and NOAA said they did not 
retrieve their peer review records by individual name or personal identi- 
fier and therefore were not required to classify them as Privacy Act 
records. We discovered, however, that DOE retrieved records on three 
occasions using the name of the applicant and therefore should have 
been complying with the Privacy Act. NOAA installed a new computer 
system in October 1990 that was also capable of retrieving records 
through the name of the applicant. Because this information is easily 
accessible through use of a personal identifier, we believe that both DOE 
and NOAA should establish their peer review records as Privacy Act 
records. 


All six agencies maintained similar files documenting the peer review 
process, including separate files for each application. Also, we did not 
discover any irrelevant personal information concerning applicants in 
the files we reviewed. With regard to applicants’ right to access their 
records under the Privacy Act, we discovered only a few requests for 
such records. However, all six agencies routinely provided feedback to 
applicants on the results of the peer review. Our review of 215 files 
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showed no instances where such feedback of evaluative information on 
the peer review process was denied or appeared to be incomplete. 


Four of the six agencies—vVA, NEH, NSF, and NIH—chartered or were char- 
tering their peer review panels as FACA advisory committees. DOE and 
NOAA did not charter any of their panels under FACA: they did not believe 
that their panels met the FACA criteria for advisory committees because 
the two agencies did not seek consensus advice from their panels. NIH 
chartered 140 panels under FAcA but had about 30 unchartered panels 
during fiscal year 1990. NIH also did not believe that their unchartered 
panels met the FACA criteria because the agency did not seek consensus 
advice from its panels. Although we did not test to determine if actual 
operation of these panels was in violation of FACA, we believe that 
agency and public interest would be best served by chartering these 
panels under FacA. Chartering would provide such benefits as public 
notice of panel meetings, and allowing the agencies to more fully use the 
panels to obtain consensus advice. 


Peer review has been used by the federal government to review research 
proposals since the National Advisory Cancer Council was established in 
1937. Today, more than a dozen agencies have grant programs that use 
outside experts in the peer review process. The six agencies we reviewed 
award about $3.7 billion annually in grants, many of which are subject 
to peer review. 


In a peer review, each grant application is assessed by experts for 
funding on the basis of one or more factors. These factors may include 
scientific, technical, or artistic merit; the significance of the proposed 
project; the qualifications of the applicant; and the adequacy of the pro- 
posed methodology. 


Agencies generally manage peer reviews by one of the following 
methods: (1) bringing a group of peer reviewers together as a panel at 
one location to provide oral and written comments, or (2) obtaining indi- 
vidual written comments from peer reviewers through the mail. Agen- 
cies may also use a combination of panel meetings and mail-in reviews. 


The peer review process is kept confidential to protect both the appli- 
cant and the reviewers. The applicant is protected from public disclo- 
sure of personal information. Confidentiality also helps ensure that peer 
reviewers will give candid comments on grant applications by protecting 
reviewers from possible reprisal by applicants. Both the Privacy Act 
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and FACA provide a legal basis to ensure the confidentiality of the peer 
review process. The Privacy Act provides agencies the authority to pro- 
tect the written records kept in individual applicant files from public 
disclosure. FACA provides agencies the authority for closing panel meet- 
ings to the public and protecting any personal information in the min- 
utes of panel meetings from public disclosure. 


We have issued three reports that deal with the awarding of grant 
funding. In 1987 we issued two reports on the role of the peer review 
process in university funding,” and in 1986 we reported on discretionary 
grant awards.’ 


The Privacy Act provides a statutory framework for controlling the col- 
lection, maintenance, dissemination, and use of personal information 
about individual citizens. It requires agencies to protect personal infor- 
mation from unauthorized disclosure and to publish descriptions of the 
existence and nature of such records. It also gives individuals a right of 
access to review and copy the information and to secure the correction 
of any information that is not accurate, relevant, complete, or timely. 


Most of the provisions of the Privacy Act, however, apply only to fed- 
eral agency records that are maintained as a “‘system of records.” In 
order for records to be classified as a system of records they must (1) be 
under the agency’s control; (2) contain personal information, such as 
education, financial, medical, or employment history; and (3) be part of 
a group of agency records that are retrieved by the name of the indi- 
vidual or by another personal identifier. To establish a Privacy Act 
system of records, an agency must publish a notice in the Federal Reg- 
ister that describes the records, the types of individuals on whom the 
records are maintained, and for what purpose the data will be used. 
Agencies must also report to the Office of Management and Budget 
(OMB) when they establish or substantially alter systems of records. 


Under the Privacy Act, each agency that maintains a system of records 
must include only such information about an individual that is relevant 
and necessary to accomplish a purpose of the agency required by statute 


2University Funding: Patterns of Distribution of Federal Research Funds to Universities (GAO/ 
R -87/ - , Feb. 5, 1987); and University Funding: Information on the Role of Peer Review at 
NSF and NIH (GAO/RCED-87-87FS, March 26, 1987). 


3Discretionary Grants: Opportunities to Improve Federal Discretionary Award Practices (GAO/ 
HRD-86-108, Sept. 15, 1986). 
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or executive order. Further, the act requires that records be maintained 
with such accuracy, relevance, timeliness, and completeness as is rea- 
sonably necessary to ensure fairness to the individual. 


The Privacy Act requires that if an agency maintains or retrieves 
records by the use of a personal identifier, the records must be set up as 
a Privacy Act system of records. However, the act does not require an 
agency to maintain or retrieve its records by a personal identifier, even 
where the records may contain personal information. Consequently, 
agencies that maintain and retrieve such records through other means, 
such as an assigned application or grant number or the name of the 
employing institution, are not required to comply with the requirements 
of the act. However, by establishing peer review records under the Pri- 
vacy Act, an agency can ensure that individuals will benefit from the 
protections provided by the act. 


Four agencies—VA, NEH, NSF, and NIH—retrieved peer review records by 
a personal identifier and therefore designated their peer review records 
as Privacy Act systems of records. We verified that notices of these sys- 
tems of records were published in the Federal Register as required by 
the Privacy Act. 


The other two agencies—DOE and NOAA—normally retrieved their 
records either by organization name—usually a university or other 
institution—or by an application number that the agency assigned. In 
addition to paper files, both agencies have automated application 
tracking systems that allow the agencies to search for and retrieve files 
by the name of the applicant. The paper files normally contain personal 
information about the applicant. 


We discovered, however, that the DoE official responsible for the 
tracking system had retrieved individual proposal files several times 
during fiscal year 1990 by searching the automated system for the 
applicant’s name. An official of DOE’s Office of the General Counsel said 
this practice would constitute retrieval of records by a personal identi- 
fier, as defined in the Privacy Act, therefore making the records subject 
to the act. We agree with this position. 


NOAA’s automated tracking system did not contain information on the 
applicant before October 1, 1990. On that date, NOAA implemented a 
redesigned system that added the applicant’s name to each record and 
now gives NOAA the capability to retrieve records using the applicant’s 
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name. NOAA Officials said that for grant management purposes, they 
would like to retrieve records by a personal identifier, which would 
mean they would have to comply with the Privacy Act. 


The six agencies generally maintained similar records of the grant 
award process. The peer review records we reviewed generally included 


the original grant application and proposal; 

correspondence between the applicant and the agency, including feed- 
back on the peer review; 

copies or summaries of peer review comments, including written 
reviews and summaries of panel discussions; and 

award/rejection letters for grant funding. 


The records were maintained either by an individual agency project 
officer or in central files for each division or program. The records were 
generally the same whether they were classified as Privacy Act records 
or not. 


We did not find any information in the 215 grant application files we 
reviewed that dealt with irrelevant personal activities of the applicant 
or was otherwise unrelated to a review of the merits of the application. 
Further, agency officials said they virtually never received such infor- 
mation, and if they did, they would not place it in peer review files or 
allow it to be considered during peer review deliberations. 


In response to our request, agency Privacy Act officials reviewed their 
records to determine if any applicants had submitted a request for 
access to their peer review records under authority of the Privacy Act. 
Officials at two agencies said that they had received Privacy Act 
requests. Privacy Act officials said that the Division of Research Grants 
in NIH receives fewer than 10 such requests a year, and NEH received 2 
individual Privacy Act requests during 1987 and 1988. The NIH Privacy 
Act official said that requesters usually ask for copies of the written 
reviews. However, most of the requesters drop their requests when they 
are told that they will automatically receive a summary of both panel 
and written comments. If an applicant persists, the Privacy Act official 
will forward copies of the written reviews to the applicant if they are 
available. 
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The two NEH requests were treated as both Privacy Act and Freedom of 


Minor Privacy Act 
Violations 


Information Act requests. In response, NEH provided copies of the panel- 
ists’ written comments, panel summaries, and other information, such as 
lists of panel and National Council members. Citing the Freedom of 
Information Act, Privacy Act, and implementing regulations, NEH 
removed the peer reviewers’ names from the written comments. 


While we were able to discover only a few instances in which access was 
requested under the Privacy Act, we found many other instances in 
which applicants were provided feedback on the peer review process, 
which may explain the small number of Privacy Act requests. Feedback 
to applicants was provided automatically by NIH, NSF, and VA and upon 
written or oral request by NEH, DOE, and NOAA. For example, NEH pro- 
vided feedback by letter upon request. The letter, depending on the 
wording of the request, included (1) the reasons for NEH’s actions and (2) 
a critique of the proposed project. The feedback was based on both 
written reviews and notes taken by NEH staff during panel discussions. 
NSF automatically provided applicants with copies of written reviews 
and panel summaries for proposals reviewed by peer review panels. 


On the basis of our discussions with agency officials and the documents 
in the 215 files we reviewed, it appeared that applicants were provided 
information from their files in the form of an official notice of accept- 
ance or rejection for grant funding. In addition, the agencies generally 
provided an explanation of the reasons for their decisions and copies or 
summaries of peer review comments. To protect the identity of peer 
reviewers, their names were not provided on the copies or the summa- 
ries of the peer review comments that were sent to the applicant. Fur- 
ther, our review of the documents in the 215 files revealed no instances 
where feedback of evaluative information on a project or individual was 
denied or appeared to be incomplete. 


We noted several minor Privacy Act violations at NEH and VA. NEH did not 
adequately safeguard inactive Privacy Act files, and vA improperly 
maintained a small system of records that should have been classified as 
Privacy Act records but were not. At both agencies the “routine use 
statements,” which describe the purposes for which records can be 
released, did not indicate that these records were used in the peer 
review process. 
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The Privacy Act requires federal agencies to protect Privacy Act files 
from improper disclosure. NEH did not adequately protect inactive grant 
files that were in the process of being transferred to storage. We noted 
open boxes of grant proposal files in the corridor of NEH offices, which 
could allow unauthorized people to gain access to the files. 


An NEH Official said that because of space limitations, inactive files are 
moved to the corridor, where they are to be promptly picked up for 
storage. Through oversight, the files we observed were not picked up 
promptly. However, after we brought this matter to NEH’s attention, offi- 
cials had them transferred to storage and assured us that in the future 
records would be sent to storage in a timely manner. 


A VA official had files on six cases of scientific misconduct that were 
being investigated by vA. Although the files were not peer review files, 
they contained personal information and were retrieved by the name of 
the researcher involved, which would qualify the files as Privacy Act 
records. 


At our request, a VA Privacy Act official reviewed these files and deter- 
mined that they qualified as Privacy Act records but were not recog- 
nized as such. Another va official said that the files were informational 
and did not contain original investigative records. The original investiga- 
tion records were maintained at the medical centers that conducted the 
investigations, according to VA. In order to resolve the issue, VA officials 
decided that rather than set up a Privacy Act system of records, the 
records that contained the personal information would be transferred to 
the office’s medical center files. The medical center files are not 
retrieved by name or personal identifier and thus are not Privacy Act 
records. 


The Privacy Act defines routine use as the disclosure of a Privacy Act 
record only for a purpose compatible with the purpose for which the 
data were collected. The routine uses for each Privacy Act record are 
required to be described in its Privacy Act notice in the Federal Register. 


Routine use statements for NEH and VA grant application files did not 
include peer review as a routine use for the information in the files. For 
example, NEH’s routine use statement for its grant application files 
describes the following routine uses for the data: 
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“General administration of grant review process; statistical research; congressional 
oversight and analysis of trends; disclosure may be made to a congressional office 
from the record of an individual in response to an inquiry from the congressional 
office made at the request of the individual about whom the record is maintained.” 


NEH and VA officials agreed that Privacy Act routine use statements for 
grant application files did not indicate that these records would be used 
in the peer review process. Officials also said that they would revise the 
routine use statements to include the peer review process. NEH’s revised 
routine use statement was published in the September 13, 1990, Federal 
Register and va’s was published in the December 24, 1990, Federal 
Register. 


Compliance With 
FACA 


FACA governs the establishment and operation of committees that pro- 
vide advice or recommendations to federal agencies or officials. The act 
requires that each federal advisory committee have a charter that speci- 
fies, among other things, the committee’s objectives, duties, number and 
frequency of meetings, and establishment and termination dates. A com- 
mittee is considered chartered if it is under FACA and unchartered if it is 
not under FACA. 


Applicability of FACA 


FACA defines an advisory committee as any committee, board, panel, or 
other similar group that includes at least one nonfederal employee and 
that makes recommendations. An example of an advisory meeting or 
group not covered by FAca is any meeting initiated by a federal offi- 
cial(s) with more than one individual for the purpose of obtaining the 
advice of individual attendees and not for the purpose of using the 
group to obtain consensus advice or recommendations. However, FACA 
regulations state that such a group would be covered by Faca if an 
agency accepts the group’s deliberations as a source of consensus advice 
or recommendations. 


As shown in table 1, the six agencies used about 469 peer review panels 


to review grant proposals during fiscal year 1990. About 428 (90 per- 
cent) of those panels were chartered and 41 were unchartered. 
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Table 1: Peer Review Panels Used by 
Each Agency During Fiscal Year 1990 


Sea eres See eee a ae ee tel tan UN Ne Seng 
Panels chartered 


Agency under FACA Unchartered panels 
NEH 200 

VA Ve 

NSF 71 Unknown 
NIH 140 30 
DOE 5 
NOAA 6 
Total 428 41 


Two agencies—NEH and va—chartered all of their panels. At the end of 
the fiscal year, NSF had chartered 71 panels and expected to charter 
another 12 to 14 panels that would meet in fiscal year 1991.4 


NIH formed unchartered panels if there were too many proposals for a 
chartered panel to review during a normal meeting or to prevent a pos- 
sible conflict of interest if a member of a chartered panel submitted a 
proposal to be reviewed. The chartered panels reviewed about 98 per- 
cent of NIH’s proposals while the unchartered panels reviewed the 
remaining 2 percent. 


Agency officials at DOE, NIH, and NOAA said that their unchartered panels 
were not considered advisory committees under FACA because they did 
not seek consensus advice from those panels, which they generally con- 
sidered to be temporary. 


For example, DOE officials said that although most of their grants are 
reviewed by reviewers who mail in their comments, they had estab- 
lished unchartered, temporary panels for five grant programs during 
fiscal year 1990. The panels usually consisted of 12 to 18 members. One 
or two panel members were normally responsible for preparing written 
reviews of each proposal and leading the panel discussion of the pro- 
posal. At the conclusion of the discussion, each panel member rated the 
proposal on a 10-point scale. The ratings were done on an individual 


4NSF officials said that as a result of an internal study, they had decided to charter virtually all 
proposal review panels. According to the officials, this action would (1) ensure compliance with FACA 
and (2) provide greater flexibility in using panels to achieve a consensus. 


NSF decided to charter about 35 new panels. Twenty-two panels were chartered during fiscal year 
1990. The remaining 12 to 14 panels will be chartered during fiscal year 1991. The 35 panels were in 
programs such as the Presidential Young Investigator Program and the Small Business Innovation 
Program. Officials said proposals in these programs were previously reviewed by mail or by previ- 
ously unchartered panels. 
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basis, and according to DOE officials, there was no attempt to obtain 
panel consensus. 


However, we did not do tests to determine whether DOE, NOAA, and NIH 
accepted the deliberations of their unchartered panels as a source of 
consensus advice or recommendations. While we recognize that agencies 
may legally use unchartered committees by not seeking consensus 
advice, we believe this activity puts limitations on the amount and type 
of information agencies can obtain from the panels. We also believe that 
unchartered committees require agency officials to provide careful, day- 
to-day vigilance of individual panel meetings to ensure that panels do 
not provide consensus or that the agency does not use the panel results 
as a source of consensus advice—either of which would violate FACA. 
Furthermore, establishing panels outside the scope of FACA limits the 
benefits the act is intended to provide. While the proceedings of peer 
review panel meetings are normally closed to the public, FACA requires a 
public notice of the existence of the panels and when and where they 
meet. FACA also requires that summary minutes of the panel meetings be 
made available to the public. 


Generally, FACA requires that (1) advisory committee meetings be open to 
the public and (2) minutes be kept and promptly made available for 
public inspection. However, if an advisory committee meeting is likely to 
disclose personal, privileged, or confidential information, FacA provides 
authority for the agency to close the meeting to the public and protect 
the minutes from public disclosure. Chartered peer review panel meet- 
ings in NIH, VA, NEH, and NSF were closed to the public for the above rea- 
sons when grant applications were being discussed and ranked. Minutes, 
which were available for public inspection, were prepared but contained 
only brief agenda-type information, such as schedule and attendance. 


However, agency officials said that because of the sensitive nature of 
the material discussed—personal, privileged, and confidential—the 
detailed summaries of the panels’ discussions were placed only in indi- 
vidual applicant files. These summaries were made available only to 
agency personnel, peer review panel members, and the applicants. 
Although we did not test the agencies’ compliance with these proce- 
dures, we believe that, if followed, such procedures would comply with 
FACA requirements. 


Agency officials said unchartered peer review panel meetings in NIH, 
DOE, and NOAA were also closed to the public to protect the privacy of 
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grant applicants and peer reviewers. The unchartered panels did not 
keep minutes but did prepare detailed summaries or notes for the panel 
sessions. Similarly, these agency officials said that the detailed summa- 
ries of the panels’ discussions were placed in individual applicant files 
and made available only to agency personnel, peer review panel mem- 
bers, and the applicants. However, we did not test to determine if the 
agencies were complying with these procedures. 


DOE Officials said their authorizing legislation generally prohibits closing 
advisory committee meetings on research and development, unless the 
closing is due to national security reasons or the protection of privileged 
information. However, this legislation does not allow the closing of panel 
meetings to protect personal information. Consequently, DOE believes 
that if it charters its peer review panels under FACA it would not be able 
to close the meetings to prevent the disclosure of personal information. 
Although we agree with this position, we believe that as a matter of 
public policy, DOE should make every effort to bring its peer review 
panels under FACA. 


Because DOE used its automated tracking system to retrieve applications 
by a personal identifier, it should have set up its peer review records as 
Privacy Act records. At the time of our review, NOAA was not in viola- 
tion of the Privacy Act. However, on October 1, 1990, it became capable 
of retrieving application files by name or personal identifier. This capa- 
bility, along with NoOAA’s stated desire to use this capability, indicates 
that it would be appropriate for NOAA to establish a Privacy Act system 
of records for its automated and manual peer review records. 


The Privacy Act violations noted at VA and NEH do not appear to be sys- 
temic. In both cases, agency officials took prompt steps to correct the 
violations. As a result we are not making any recommendations to VA or 
NEH. 


Although we did not note any violations of FAcA, we believe that the 
general interests of the public in disclosure of governmental affairs 
would best be served by chartering the peer review panels at NIH, DOE, 
and NOAA, as is done at the other agencies we reviewed. In addition, the 
agencies would benefit from the additional flexibility that FACA allows in 
the use of advisory committees to obtain consensus advice. Such cov- 
erage would remove the need for agency officials to provide day-to-day 
policing of meetings to avoid FACA violations. Consequently, we believe 
that NOAA and NIH should charter all of their peer review panels. We 
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believe the same rationale applies to DOE, but we recognize the dilemma 
that its authorizing legislation imposes on the closing of meetings. 


We recommend the following: 


The Secretary of Energy and Secretary of Commerce should establish 
their peer review files and automated grant application tracking sys- 
tems as Privacy Act systems of records. 

The Secretary of Commerce and Secretary of Health and Human Ser- 
vices should charter their respective department’s peer review panels. 
The Secretary of Energy should seek an amendment to its authorizing 
legislation that would allow Energy to charter its peer review panels but 
still protect the privacy of the grant applicants and peer reviewers. Fol- 
lowing that change, we recommend the Secretary charter Energy’s peer 
review panels. 


We obtained comments on this report from the six agencies we reviewed. 
We also obtained comments from OMB, which has an overall policy 
responsibility for the Privacy Act. Comments received from DOE, the 
Department of Commerce on behalf of NOAA, the Department of Health 
and Human Services on behalf of NIH, and OMB are printed in full in 
appendixes I through IV. We also discussed our findings with NEH, VA, 
and NSF. All six agencies reviewed agreed with the facts in the report 
and several agencies suggested technical changes to the material, which 
were incorporated as appropriate. 


DOE and NOAA both concurred in the recommendation to establish their 
peer review records as Privacy Act systems of records. However, DOE, 
NOAA, and NIH did not concur in the recommendation to charter their 
peer review panels under FACA. All three agencies referred to their 
panels as ad hoc or temporary and said that they seek only the indi- 
vidual advice of panel members, not consensus advice. Further, DOE 
pointed out that we did not find any peer review panels to be in viola- 
tion of FACA. 


FACA regulations do not recognize ad hoc or temporary panels as justifi- 
cation for exemption from chartering and other FACA requirements. Fur- 
ther, while agencies seeking only individual advice could exempt a panel 
from FACA’s chartering and other requirements, we believe, as we 
pointed out previously, that the general interests of the public in disclo- 
sure of governmental affairs would best be served by chartering the 
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peer review panels at DOE and NOAA, as is done at the other agencies we 
reviewed. Because of the public policy benefits, we believe that the 
agencies should have compelling reasons for structuring their panels so 
that they would not be subject to FacA. We do not believe that DOE or 
NOAA presented compelling reasons for not chartering their peer review 
panels. Although DOE correctly pointed out that we did not find any peer 
review panels in violation of FACA, it should be noted that we did not do 
any tests to determine whether unchartered panels were used 
improperly. 


In addition, DOE said that it concurred in our recommendation that it 
seek ways to amend its authorizing legislation regarding departmental 
advisory committees. Our recommendation, however, was much more 
specific: we recommended that the Secretary of Energy seek an amend- 
ment that would allow DOE to close peer review panel meetings, specifi- 
cally to protect the privacy of grant applicants and peer reviewers. 
Following that change, we recommended that the Secretary charter 
DOE’S peer review panels. 


DOE’s suggestion in its comments that it would seek to amend its author- 
izing legislation to cover advisory committees other than peer review 
panels goes beyond our recommendation. We cannot comment on the 
advisability of amending DOE’s authorizing legislation to cover other 
advisory committees. Furthermore, DOE’s proposal to amend its legisla- 
tion without the intention of chartering its peer review panels is not con- 
sistent with our recommendation. 


NIH stated that it agreed in principle that panels should be chartered and 
agreed to take steps to charter ad hoc panels that provide consensus 
advice. However, NIH stated that it was not practical to charter commit- 
tees that only meet one time. While we recognize that chartering panels 
that meet one time may be an administrative burden, FACA does not rec- 
ognize this as a reason for not chartering those panels. NIH may have to 
streamline its chartering process or consider other options such as char- 
tering several generic panels which can have differing membership each 
time they meet. This approach is used by NEH and NSF. 


In addition, NIH stated that the Public Health Service Act (section 
492(a)(2)) might be interpreted as directing NIH to continue using 
unchartered panels in these situations. We could not find any language 
that would indicate that it was Congress’ intent that NIH continue to use 
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unchartered panels. Unless NIH can produce a clear indication of con- 
gressional intent to the contrary, we believe that NIH should charter all 
peer review panels, including one-time panels. 


OMB suggested two changes in the report. In response to their sugges- 
tions, we added a reference making it clear that agencies must also 
report to OMB when they establish or substantially alter systems or 
records. In addition, OMB suggested a change that had to do with agency 
procedures for withholding information that might disclose the identity 
of individual peer reviewers. In order to withhold this information, an 
agency must publish Privacy Act regulations stating their intention to 
use one of the Privacy Act exemptions. In the context of peer review, 
exemption (k)(5), has been used by agencies to withhold the names of 
peer reviewers. 


OMB noted that it was unclear from the discussion in the report whether 
agencies were withholding information requested from records based 
upon a properly taken exemption from the Privacy Act. Although we 
did not discuss this issue in the report, we found that NSF and NEH had 
issued Privacy Act regulations stating their intention to exempt from 
the access provision of the act any material that would disclose the iden- 
tity of individual peer reviewers, based on the Privacy Act exemption in 
paragraph (k)(5). We believe the existence of these regulations is 
responsive to OMB’s concerns. 


NIH and vA did not issue Privacy Act regulations indicating their inten- 
tion to exempt their records from the disclosure provisions of the act. 
However, we believe such regulations would not be necessary for these 
agencies because NIH’s peer review records do not contain the names of 
the peer reviewers, and VA said that it does not intend to invoke Privacy 
Act exemption (k)(5). As noted earlier, DOE and NOAA did not set up their 
peer review records as Privacy Act systems of records, but now that 
they have expressed an intention to do so, they should be aware of OMB’s 
concern. 
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As agreed with the Committee, we are sending copies of this report to 
the heads of the six agencies where we did our work, the Director of the 
Office of Management and Budget, and other interested parties. 


The major contributors to this report are listed in appendix V. If you 
have any questions about this report, please call me at (202) 275-8676. 


Sincerely yours, 


Nye Saas 


L. Nye Stevens 
Director, Government Business 
Operations Issues 
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and Budget 


Now on p. 5. 


Now on p. 16. 


EXECUTIVE OFFICE OF THE PRESIDENT 
OFFICE OF MANAGEMENT AND BUDGET 
WASHINGTON, D.C. 20503 


ait 1) os 


OSES ay a (mre 


Mr. James F. Bouck 

Evaluator 

General Government Division 
General Accounting Office 

441 G Street, N.W.; Room 3826 
Washington, D.C. 20548 


Dear Mr. Bouck: 


We have reviewed your draft report entitled "Peer Review - 
Compliance with the Privacy Act and Federal Advisory Committee 
Act." In general, it appears that the agencies surveyed are 
complying with the provisions of both Acts, albeit with minor 
deviations. We offer the following specific comments: 


Oo Page 9, paragraph beginning "Most...used." We recommend 
that for completeness, you should add the following sentence 
at the end of the paragraph: "Agencies must also report to 
the Office of Management and Budget when they establish or 


substantially alter systems of records." 


o Pages 13 and 14. Agencies reported deleting the names of 
panelists when responding to first party requesters citing 
the Privacy Act. We are troubled by this practice. It does 


not appear to be consistent with the Privacy Act which 
permits withholding records only under very specific 


circumstances, i.e., when the agency has exempted the system 
under one of the general or specific exemption provisions of 


the Act. Only one of those provisions appear to be valid 
for purposes of exempting records relating to the peer 
review process, and it is unclear from the discussion 


whether the agencies were withholding records based upon a 


properly taken exemption. We recommend you examine this 


practice more closely to determine whether it is, in fact, 
proper. 


Sincerely, 


h. Mite. 


ames B. MacRae, Jr. 
Acting Administrator and 

Deputy Administrator 
Office of Information and 
Regulatory Affairs 
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oer 7% 
f YW UNITED STATES DEPARTMENT OF COMMERCE 
eee ae The Assistant Secretary for Administration 
% Ue) £ | Washington, D.C. 20230 

me ot 


oe EN 


Mr. Richard Fogel 

Assistant Comptroller General 
General Accounting Office 

U.S. General Accounting Office 
Washington, D.C. 20548 


Dear Mr. Fogel: 


Thank you for your letter requesting comments on the draft report 
entitled, "Peer Review: Compliance with the Privacy Act and 
Federal Advisory Committee Act." 


We have reviewed the enclosed comments of the Under Secretary for 
Oceans and Atmosphere and believe they are responsive to the 
matters discussed in the report. The Department supports the 
strengthening of NOAA's environmental data management archival 
program and is committed in helping NOAA accomplish this task. 


Assistant SecFetary 
Administration 


Enclosure 
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UNITED STATES DEPARTMENT OF COMMERCE 
The Deputy Under Secretary for 

Oceans and Atmosphere 

Washington, 0.C. 20230 


JAN 15 [99! 


Mr. Richard L. Fogel 

Assistant Comptroller General 

United States General Accounting Office 
Washington, D.C. 20548 


Dear Mr. Fogel: 


Thank you for your letter to Secretary Mosbacher regarding the 
GAO draft report, "Compliance with the Privacy Act and Federal 
Advisory Committee Act" (GAO assignment code 240017). 


The report recommends that NOAA peer review files and automated 
grant application tracking system files be established as 
"Privacy Act systems of records." To be classified in this 
manner the records must be retrievable by an individual name or 
by some identifying number or symbol assigned to an individual 

Now on p. 5. (page 9). Currently, NOAA's peer review files cannot be 
retrieved in this manner. Therefore, we do not intend to pursue 
Privacy Act coverage for these records. However, since our new 
automated grant application tracking system can retrieve records 
based on the name of the principal investigator, we agree that we 
should establish our automated tracking system as a "Privacy Act 
system of records." We intend to take appropriate action to do 
so. 


The report also recommends that NOAA charter its peer review 
panels. The Federal Advisory Committee Act (FACA) covers panels 
when an agency uses a panel to obtain advice or recommendations 
when group consensus is obtained or sought. Since NOAA panels 
are almost always temporary, since NOAA program offices often 
send out applications for individual (rather than group) peer 
review, and since the value in NOAA of such panels resides in 
individual evaluations and recommendations, we do not intend to 
charter our panels under FACA. 


I want to compliment you and your staff for a thorough job on two 
complex issues. Thank you for the opportunity to comment. 


Sincerely, 
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The Under Secretary of Energy 
Washington, DC 20585 


January 11, 1991 


Mr. Richard L. Fogel 

Assistant Comptroller General 
General Government Division 
U.S. General Accounting Office 
Washington, DC 20548 


Dear Mr. Fogel: 


The Department of Energy (DOE) appreciates the opportunity to review and 
comment on the General Accounting Office (GAO) draft report entitled "Peer 
Review: Compliance with the Privacy Act and Federal Advisory Committee Act." 
The GAO review assessed compliance with selected provisions of the Privacy Act 
and the Federal Advisory Committee Act in the peer review process at six 
agencies. The draft report contains two recommendations addressed to the 
Department of Energy. 


The first recommendation is that the Secretary of Energy establish the 
Department's peer review files and automated grant application tracking 
systems as Privacy Act systems of records. We concur in that recommendation 
and will proceed to establish the subject systems of records for the Office of 
Energy Research's automated systems. 


The second recommendation contains two parts. The first part recommends that 
the Secretary of Energy seek an amendment to the Department's authorizing 
legislation regarding Departmental advisory committees. Such an amendment 
would allow the Department to close advisory committee meetings on research 
and development for reasons other than national security and the protection of 
privileged, but not including personal, information. The second part of the 
recommendation is that, following the amendment of the Department's 
authorizing legislation, the Secretary charter the Department's ad hoc peer 
review panels. 


The Department's authorizing legislation places unique restrictions on DOE 
advisory committees. We know of no other Federal agency funding scientific 
and technological research that is required to have its advisory committees 
discuss personal information, including the merits of the scientific ideas and 
research performance of individuals, in open public session. The recommended 
amendment would provide the Department with the same flexibility in the use of 
advisory committees that other Federal agencies currently have. For this 
reason, the Department concurs with this part of the recommendation and wil] 
consider all of the implications, as well as the ways to propose such a change 
to its authorizing legislation. 
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With regard to the recommendation to charter peer review panels, the 
Department nonconcurs. It should be noted that the GAO, in its review of the 
procedures described by the Department for the conduct of its ad hoc peer 
review panels, did not find them to be in violation of FACA. These ad hoc 
panels are used under special circumstances, such as when there are an 
unusually large volume of proposals or the time for review is exceedingly 
short. These ad hoc panels are a mechanism to obtain the advice of a number 
of individuals, as individuals. They are not used by Department officials to 
obtain consensus advice and thus are not advisory committees under the GSA 
regulation. 


DOE grant and contract regulations, along with such legislation as the Privacy 
Act and Freedom of Information Act, recognize that there are legitimate 
exemptions from public disclosure, including those cited in the Freedom of 
Information Act relating to pre-decisional matters. We believe that the 
Department's ad hoc peer review panels operate effectively in support of the 
procurement and assistance process and in compliance with Departmental and 
statutory requirements. We will continue to be vigilant about the operations 
of our ad hoc peer review panels. As a part of that effort, written 
procedures will be developed and implemented immediately. The procedures will 
set forth the peer review panel process and will be provided to all reviewers 
in advance. A DOE official is always in attendance at these panel meetings, 
and it will be the responsibility of that individual to ensure compliance with 
the procedures. 


In summary, the Department does not believe that GAO has provided a compelling 
rationale based on law or existing regulation for its recommendation to 
charter peer review panels. Adopting this part of the GAO recommendation 
would deprive the Department of an effective legal tool for meeting demands on 
its peer review system. 


We hope that the comments will be helpful to GAO in its preparation of the 
final report, and would be happy to discuss them with you. 


Sincerely, 


pe 


John C. Tuck 
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Comments From the Department of Health and 
Human Services 


Note: GAO comments 
supplementing those in the 
report text appear at the 
end of this appendix. 


vii 
Sees 
+ 4 


Cr DEPARTMENT OF HEALTH & HUMAN SERVICES Office of Inspector General 


ere Washington, D.C. 20201 


FEB an? 109] 


Mr. Richard L. Fogel 
Assistant Comptroller General 
United States General 
Accounting Office 
Washington, D.C. 20548 


Dear Mr. Fogel: 


Enclosed are the Department's comments on your draft report, 
"Peer Review: Compliance with the Privacy Act and Federal 
Advisory Committee Act." The comments represent the tentative 
position of the Department and are subject to reevaluation when 
the final version of this report is received. 


The Department appreciates the opportunity to comment on this 
draft report before its publication. 


_—Sincer ly yours, 
oon) \, yu) 


Richard P. Kusserow 
Inspector General 


¢ 


Enclosure 
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COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES ON 
THE GENERAL ACCOUNTING OFFICE’S DRAFT REPORT, "PEER REVIEW: 
COMPLIANCE WITH THE PRIVACY ACT AND THE FEDERAL ADVISORY 
COMMITTEE ACT," REPORT NO, GAO.GGD-91-UNDATED 


General Comments 


As part of its limited assessment of compliance with the 
Privacy Act and the Federal Advisory Committee Act (FACA), the 
General Accounting Office (GAO) noted that the National 
Institutes of Health (NIH) utilized some unchartered panels in 
its peer review processes during Fiscal Year 1990. 


The NIH operates a tightly scheduled review of grant 
applications three times per year. It schedules the meetings 
far in advance in order to ensure that the majority of regular 
panel members will be present. However, NIH is not able to 
determine the number of applications that each chartered panel 
will review. This is particularly difficult in newly emerging 
areas of science such as AIDS and biotechnology or where highly 
sophisticated and innovative technologies are proposed in 
established areas of science. In addition, when (1) a member 
of a particular review panel, or (2) someone with whom that 
member has a close professional relationship submits a grant 
application that normally would be reviewed by that panel, to 
avoid any conflict of interest, arrangements are made to 


provide for technical evaluation of that application by another 
group, frequently an ad hoc panel. 


Thus, the NIH employs ad hoc panels in response to 
unpredictable situations. The Agency uses ad hoc panels in 
more predictable situations as well, such as when the NIH 
requests applications for investigation of a particular area of 
science. The NIH selects ad hoc panels to review those grant 
applications because they are one-time situations and the 
reviewing group must be tailor-made to fit that solicitation. 


Section 492(a)(2) of the Public Health Service Act states that 
peer review regulations promulgated by the NIH shall require 
that the review of applications for grants, contracts, and 
cooperative agreements be conducted, to the extent practicable, 
in a manner consistent with the system for technical and 
scientific peer review applicable on the date of enactment of 
the Health Research Extension Act of 1985, i.e., November 20, 
1985. The NIH today is operating ad hoc review groups in the 
same manner that it was on November 20, 1985. A strong 
argument could be made that the intent of the Congress was that 
these committees continue operating without béing subject to 
the FACA. In light of the above, the NIH has continued to 
operate in this fashion for the last several years. 
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While the GAO findings applicable to the Department of Health 
and Human Services (DHHS) in the draft report are limited to 
NIH, they have implications for the Alcohol, Drug Abuse, and 
Mental Health Administration (ADAMHA) as well as other DHHS 
agencies. In that regard, ADAMHA also uses ad hoc peer review 
committees to review applications received in response to 
Requests for Applications proposing projects in highly 
specialized areas (where expertise is not available on any one 
particular ongoing chartered peer review committee) and for 
conflict of interest situations with regular review committee 
members. 


The following comments are provided on the recommendation. 
GAO Recommendation 
The Secretary of Commerce and the Secretary of Health and Human 


Services charter their respective department’s peer review 
panels. 


Department Comment 


We agree in principle that the peer review panels should be 
chartered whenever possible. However, from the text of the 


report, it is evident that the intent of this recommendation is 
directed primarily to ad hoc review panels. In that regard, 
while we support the notion that committees should be 
chartered, this simply is not practical for committees which 
are truly one time only. 


There are legitimate needs for one time review groups such as 
when programs are being started, when time frames are short and 
for special situations such as conflict of interest, for which 
chartering, formal appointments, and the other requirements of 
FACA are neither practical nor cost effective. However, every 
effort will be made to ensure that ad hoc committees are used 
only for one time and conflict of interest situations. 


In selected instances, a minimal but continuing need exists to 
use ad hoc consultants in situations that do not require group 
actions or consensus advice and, thus, would fall outside the 
FACA. Such ad hoc consultants are an important complement to 
the Department’s peer review system, the cornerstone of many 
agency’s operations in fulfilling their mission. 


Technical Comments 


Now on p. 12. On pages 6 and 24 of the draft report, the statement is made 
S t that chartering would provide benefits such as ". . .removing 
Sn aad the need for day-to-day policing of panel meetings by agency 


officials to avoid FACA violations." The FACA states [Sec. 
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10(e)] that a Federal official must be present at all committee 
meetings, so this is an incorrect statement. 


Now on p. 8. On page 14, the third sentence in the first full paragraph 
See comment 2 could be misconstrued. It states: "To protect the identity of 
; peer reviewers, their names were deleted from the copies or the 
summaries of the peer review comments that were sent to the 
applicant." The intent may have been to state that the 
summaries were written in such a manner that specific comments 
could not be attributed to a specific reviewer, which is 
correct. However, it should be noted that the complete rosters 
of all reviewers (members, Reviewers Reserve members, and ad 
hoc consultants) are provided with the summary statements so 
that the applicant is informed of the names of the entire group 
that reviewed his/her application(s). 


Page 20 of the draft report states that "Agency officials at 
DOE, NIH, and NOAA said that their unchartered panels were not 
considered advisory committees under FACA because they did not 
seek consensus advice from those panels, which they generally 
considered to be temporary." This statement is true at the NIH 
for the operation of all ad hoc panels that review contract 
proposals and for the operation of some ad hoc panels that 
review grant and cooperative agreement applications. The NIH 


Now on p. 11. 


will take steps to charter ad hoc committees that provide 
consensus advice. 
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The following are GAO’s comments on the Department of Health and 
Human Services letter dated February 7, 1991. 


Dee 
1. The statement from page 6 of the draft report (now page 4) was 

GAO Comments deleted. The wording on p. 24 of the draft report (now p. 12) was 
revised to reflect a distinction between having a federal employee pre- 
sent during panel meetings and having that employee monitor the pro- 
ceedings to ensure that the panel does not reach consensus or that the 
agency does not use the panel’s results as a source of consensus advice. 


2. The statement was reworded to indicate that the names of the peer 


reviewers were not provided on the copies of the review comments sent 
to the applicant. 
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Larry A. Herrmann, Assistant Director, Government Business 
General Government Fh COrO a a 


Division, Washington James F. Bouck, Evaluator-in-Charge 
D C Adrian Barber, Evaluator 


2 IP % rae 
Office of the General Jill Poses Sayre, Attorney-Adviser 
Counsel 
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